Files

T

alexei.dolgolyov f0739ca949 feat: security hardening — SSRF guard, template sandbox timeout, webhook log prune, auth & backup polish

- Add outbound URL validation (SSRF) for webhook/Discord/Slack/ntfy/Matrix dispatch
- Template renderer: input/output caps and thread-based render timeout
- Webhook log filter: strip Authorization/signature/token-like headers; atomic prune
- Auth/JWT/backup/config tightening; misc frontend UX fixes

2026-04-16 03:21:45 +03:00

2.4 KiB

Raw Permalink Blame History

Notify Bridge

A generic bridge between service providers and notification targets.

Notify Bridge monitors services (like Immich photo servers) for changes and dispatches notifications to configurable targets (Telegram, webhooks) using customizable templates.

Architecture

Service Providers — Connectors to external services (Immich, more coming)
Trackers — Monitor specific collections within a provider for changes
Tracking Configs — Define what events to watch for and scheduling rules
Notification Targets — Where to send notifications (Telegram chats, webhook URLs)
Template Configs — Jinja2 templates that format notifications per provider type

Project Structure

packages/
  core/       — Shared library: providers, models, notifications, templates
  server/     — FastAPI REST server with SQLite database
frontend/     — SvelteKit dashboard (Svelte 5, Tailwind CSS v4)

Quick Docker Deploy

docker run -d \
  --name notify-bridge \
  --restart unless-stopped \
  -p 8420:8420 \
  -v notify-bridge-data:/data \
  -e NOTIFY_BRIDGE_SECRET_KEY=$(openssl rand -hex 32) \
  git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge:latest

Then open http://localhost:8420 in your browser.

Environment Variables

Variable	Required	Default	Description
`NOTIFY_BRIDGE_SECRET_KEY`	Yes	—	Secret key for JWT tokens (min 32 chars)
`NOTIFY_BRIDGE_PORT`	No	`8420`	Server listen port
`NOTIFY_BRIDGE_CORS_ALLOWED_ORIGINS`	No	`*`	Comma-separated allowed CORS origins
`NOTIFY_BRIDGE_DEBUG`	No	`false`	Enable debug logging

Docker Compose

services:
  notify-bridge:
    image: git.dolgolyov-family.by/alexei.dolgolyov/notify-bridge:latest
    container_name: notify-bridge
    restart: unless-stopped
    ports:
      - "8420:8420"
    volumes:
      - notify-bridge-data:/data
    environment:
      - NOTIFY_BRIDGE_SECRET_KEY=your-secret-key-min-32-characters

volumes:
  notify-bridge-data:

Quick Start (Development)

# Backend
cd packages/server
pip install -e .
NOTIFY_BRIDGE_DATA_DIR=./test-data NOTIFY_BRIDGE_SECRET_KEY=your-secret-key-min-32chars \
  python -m uvicorn notify_bridge_server.main:app --host 0.0.0.0 --port 8420

# Frontend
cd frontend
npm install
npm run dev

Supported Providers

Immich — Photo/video server with album change detection

2.4 KiB Raw Permalink Blame History